Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
10 / 10 results
criticalbug_reportVulnerabilitySAP Cloud SDK for Python CVSS 10 flaw leaks OAuth2 credentials to attacker
SAP Cloud SDK for Python versions below 0.45.2, 0.53.0 through 0.55.0, and all 0.36.x releases. Affects multi-tenant applications on SAP Business Technology Platform (BTP) using the SDK for authentication.
criticalbug_reportVulnerabilitySAP Extended Passport Processing memory corruption flaw patched
SAP Extended Passport Processing (EPP) component across SAP products. Specific affected versions not disclosed in available information. Organizations running SAP systems with EPP functionality should assume exposure.
criticalbug_reportVulnerabilitySAP patches two critical RCE flaws in Kernel and NetWeaver (CVSS 10.0)
CVE-2026-44756 (CVSS 10.0) affects SAP Kernel versions 7.22–9.20 and WEBDISP 9.16–9.20 across KRNL64NUC, KRNL64UC, and KERNEL components. CVE-2026-58240 (CVSS 9.8) affects SAP NetWeaver Message Server in Kernel 9.16, 9.18, 9.19, 9.20.
criticalbug_reportVulnerabilitySAP Commerce Cloud, NetWeaver, MII: 4 critical flaws, 1 exploited
SAP Commerce Cloud, SAP NetWeaver, and SAP Manufacturing Integration and Intelligence (MII). Specific versions not disclosed in available data. At least 4 critical vulnerabilities confirmed.
criticalbug_reportVulnerabilitySAP Commerce Cloud CVE-2026-58231 under active exploit, 3 days post-patch
SAP Commerce Cloud, all versions prior to patched release levels. Vulnerability affects default authentication clients and endpoints lacking input validation. Unauthenticated remote exploitation possible.
criticalbug_reportVulnerabilitySAP Commerce Cloud RCE flaw (CVE-2026-58231) exploited 3 days post-patch
SAP Commerce Cloud (formerly Hybris), specifically the core Data Hub Adapter extension. All unpatched instances are vulnerable. Shadowserver tracks 4,200+ internet-exposed instances, primarily in Europe and North America.
criticalbug_reportVulnerabilitySAP Commerce Cloud critical flaw allows unauthenticated RCE (CVSS 10.0)
SAP Commerce Cloud (Data Hub Adapter). All unpatched versions are affected. The vulnerability impacts the default authentication client and certain functions lacking input validation.
criticalbug_reportVulnerabilityFortinet FortiSandbox command injection flaw enables remote code execution
Fortinet FortiSandbox products affected by CVE-2026-25089 (CVSS 9.1). Specific vulnerable versions not disclosed in provided data. Ivanti and SAP also released patches for separate critical vulnerabilities.
criticalbug_reportVulnerabilitySAP June 2026 patches fix 4 critical flaws in NetWeaver, Commerce Cloud
SAP NetWeaver and SAP Commerce Cloud products. Total of 15 vulnerabilities patched, including 4 critical-severity issues. Specific affected versions not disclosed in summary.
criticalbug_reportVulnerabilitySAP releases critical patches for multiple products
Multiple SAP products affected. Specific product names and versions not disclosed in available information. Patches released by SAP to address critical-severity vulnerabilities.